diff --git a/frontend/components/GateCard.vue b/frontend/components/GateCard.vue
new file mode 100644
index 0000000..30be180
--- /dev/null
+++ b/frontend/components/GateCard.vue
@@ -0,0 +1,489 @@
+<script setup lang="ts">
+// Tier 2 Block G — "Gate" for one event. This is the user-facing rebrand
+// of what the internal codebase still calls the fraud detector.
+//
+// The metaphor is the bouncer at the door of an event: a host tells the
+// gate how strict to be, lists a few "trusted places" their guests will
+// be arriving from, and reviews any decisions the gate has already made.
+// No CIDRs, no risk scores, no sliders by default — those live under an
+// Advanced disclosure for the rare power user.
+
+interface Thresholds {
+  medium: number
+  high: number
+  block: number
+  defaults: { medium: number; high: number; block: number }
+}
+
+interface AllowlistEntry {
+  event_id: string
+  cidr: string
+  label?: string
+  created_at: string
+}
+
+interface FeedbackEntry {
+  access_log_id: string
+  verdict: 'legitimate' | 'suspicious'
+  note?: string
+  created_at: string
+}
+
+// Friendly presets. Each maps to a (medium, high, block) triple. The
+// preset detector picks the one whose block-threshold is closest to the
+// current value; if nothing matches we render "Custom".
+//
+// Tuning rationale:
+// - Relaxed: only obvious crashers stopped. block=95 = "needs near-perfect
+//   confidence to refuse".
+// - Balanced: matches the engineering defaults (30/60/85). Most events.
+// - Strict: tight check for private events. block=70.
+// - Very strict: VIP-list level. block=55 — even mild signal mismatches
+//   get refused.
+type PresetId = 'relaxed' | 'balanced' | 'strict' | 'very_strict' | 'custom'
+interface Preset {
+  id: PresetId
+  label: string
+  description: string
+  medium: number
+  high: number
+  block: number
+}
+const PRESETS: Preset[] = [
+  { id: 'relaxed',     label: 'Relaxed',     description: 'Only stop obvious gate-crashers.',                medium: 50, high: 80, block: 95 },
+  { id: 'balanced',    label: 'Balanced',    description: 'Recommended for most parties and gatherings.',   medium: 30, high: 60, block: 85 },
+  { id: 'strict',      label: 'Strict',      description: 'Tight check — good for weddings and private events.', medium: 25, high: 50, block: 70 },
+  { id: 'very_strict', label: 'Very strict', description: 'VIP or high-profile guest list.',                medium: 15, high: 35, block: 55 },
+]
+
+const props = defineProps<{
+  eventId: string
+  yourRole?: 'owner' | 'editor' | 'viewer' | null
+}>()
+
+const canEdit = computed(() => props.yourRole === 'owner' || props.yourRole === 'editor')
+
+const config = useRuntimeConfig()
+const auth = useAuth()
+
+// --- state ---
+const loading = ref(true)
+const error = ref<string | null>(null)
+const saving = ref(false)
+
+const thresholds = ref<Thresholds>({ medium: 30, high: 60, block: 85, defaults: { medium: 30, high: 60, block: 85 } })
+const allowlist = ref<AllowlistEntry[]>([])
+const feedback = ref<FeedbackEntry[]>([])
+
+const showAdvanced = ref(false)
+const showAddNetwork = ref(false)
+const newNetworkIP = ref('')
+const newNetworkLabel = ref('')
+const addingNetwork = ref(false)
+const detectingIP = ref(false)
+
+// Toast — same pattern used elsewhere.
+type Toast = { kind: 'success' | 'error'; text: string }
+const toast = ref<Toast | null>(null)
+let toastTimer: ReturnType<typeof setTimeout> | null = null
+function showToast(t: Toast, ms = 4000) {
+  toast.value = t
+  if (toastTimer) clearTimeout(toastTimer)
+  toastTimer = setTimeout(() => { toast.value = null }, ms)
+}
+
+async function refresh() {
+  loading.value = true
+  error.value = null
+  try {
+    const [th, al, fb] = await Promise.all([
+      useApi<Thresholds>(`/events/${props.eventId}/security/thresholds`),
+      useApi<{ entries: AllowlistEntry[] }>(`/events/${props.eventId}/security/allowlist`),
+      useApi<{ feedback: FeedbackEntry[] }>(`/events/${props.eventId}/security/feedback`),
+    ])
+    thresholds.value = th
+    allowlist.value = al.entries || []
+    feedback.value = fb.feedback || []
+  } catch (e: any) {
+    error.value = useErrMessage(e, 'Could not load gate settings')
+  } finally {
+    loading.value = false
+  }
+}
+onMounted(refresh)
+
+// Which preset does the current threshold triple correspond to?
+// Exact match wins; otherwise "Custom". Selecting a preset writes its
+// triple over the current values and saves on the next click.
+const currentPreset = computed<PresetId>(() => {
+  const t = thresholds.value
+  for (const p of PRESETS) {
+    if (p.medium === t.medium && p.high === t.high && p.block === t.block) {
+      return p.id
+    }
+  }
+  return 'custom'
+})
+
+async function selectPreset(p: Preset) {
+  if (!canEdit.value) return
+  thresholds.value.medium = p.medium
+  thresholds.value.high = p.high
+  thresholds.value.block = p.block
+  await saveThresholds(true)
+}
+
+// Keep the three sliders ordered while the user drags. Without this you
+// can briefly create an invalid ordering and the server 400s on save.
+function clampOrder(which: 'medium' | 'high' | 'block') {
+  const t = thresholds.value
+  if (which === 'medium' && t.medium > t.high) t.high = t.medium
+  if (which === 'high') {
+    if (t.high < t.medium) t.medium = t.high
+    if (t.high > t.block) t.block = t.high
+  }
+  if (which === 'block' && t.block < t.high) t.high = t.block
+}
+
+async function saveThresholds(silent = false) {
+  saving.value = true
+  try {
+    await useApi(`/events/${props.eventId}/security/thresholds`, {
+      method: 'PUT',
+      body: {
+        medium: thresholds.value.medium,
+        high: thresholds.value.high,
+        block: thresholds.value.block,
+      },
+    })
+    if (!silent) showToast({ kind: 'success', text: 'Strictness saved.' })
+  } catch (e: any) {
+    showToast({ kind: 'error', text: useErrMessage(e, 'Could not save') })
+  } finally {
+    saving.value = false
+  }
+}
+
+// --- trusted networks ---
+
+// "Use my current network" — pulls the host's apparent IP from the API,
+// widens IPv4 to /24 (typical residential block) and lets the user
+// confirm before saving. /24 is a reasonable default: covers your whole
+// home network even with ISP-shuffled addresses, doesn't open up the
+// entire internet.
+async function detectCurrentNetwork() {
+  detectingIP.value = true
+  try {
+    const res = await useApi<{ ip: string }>('/me/public-ip')
+    const ip = res.ip
+    if (!ip) {
+      showToast({ kind: 'error', text: 'Could not detect your IP.' })
+      return
+    }
+    if (ip.includes(':')) {
+      // IPv6 — too risky to auto-widen at /64; default to single-host.
+      newNetworkIP.value = ip
+    } else {
+      const parts = ip.split('.')
+      if (parts.length === 4) {
+        newNetworkIP.value = `${parts[0]}.${parts[1]}.${parts[2]}.0/24`
+      } else {
+        newNetworkIP.value = ip
+      }
+    }
+    if (!newNetworkLabel.value) newNetworkLabel.value = 'My network'
+    showAddNetwork.value = true
+  } catch (e: any) {
+    showToast({ kind: 'error', text: useErrMessage(e, 'Could not detect your IP') })
+  } finally {
+    detectingIP.value = false
+  }
+}
+
+async function addNetwork() {
+  if (!newNetworkIP.value.trim()) return
+  addingNetwork.value = true
+  try {
+    await useApi(`/events/${props.eventId}/security/allowlist`, {
+      method: 'POST',
+      body: { cidr: newNetworkIP.value.trim(), label: newNetworkLabel.value.trim() || 'My network' },
+    })
+    newNetworkIP.value = ''
+    newNetworkLabel.value = ''
+    showAddNetwork.value = false
+    showToast({ kind: 'success', text: 'Trusted network added.' })
+    await refresh()
+  } catch (e: any) {
+    showToast({ kind: 'error', text: useErrMessage(e, 'Could not add network') })
+  } finally {
+    addingNetwork.value = false
+  }
+}
+
+async function removeNetwork(entry: AllowlistEntry) {
+  if (!confirm(`Stop trusting ${entry.label || entry.cidr}?`)) return
+  try {
+    await useApi(
+      `/events/${props.eventId}/security/allowlist?cidr=${encodeURIComponent(entry.cidr)}`,
+      { method: 'DELETE' },
+    )
+    showToast({ kind: 'success', text: 'Trusted network removed.' })
+    await refresh()
+  } catch (e: any) {
+    showToast({ kind: 'error', text: useErrMessage(e, 'Could not remove') })
+  }
+}
+
+function fmtDate(iso?: string | null) {
+  if (!iso) return ''
+  try { return new Date(iso).toLocaleDateString() } catch { return iso }
+}
+
+// Friendly relabelling for verdict history.
+function verdictLabel(v: string) {
+  return v === 'legitimate' ? 'Cleared by host' : 'Flagged by host'
+}
+</script>
+
+<template>
+  <section class="card">
+    <header class="mb-1 flex items-center justify-between">
+      <h2 class="text-lg font-semibold">Gate</h2>
+    </header>
+    <p class="mb-5 text-sm text-zinc-400">
+      The gate watches every guest arriving via your invitation links. Tell it how strict to be,
+      let it know about networks you trust, and it'll wave through anyone normal while flagging
+      anything that looks like an uninvited crash.
+    </p>
+
+    <p v-if="error" class="mb-3 text-sm text-red-400">{{ error }}</p>
+    <p v-if="loading" class="text-sm text-zinc-500">Loading gate…</p>
+
+    <div v-else class="space-y-8">
+      <!-- Strictness presets -->
+      <div>
+        <h3 class="mb-1 text-sm font-semibold text-zinc-100">How strict should the gate be?</h3>
+        <p class="mb-3 text-xs text-zinc-500">
+          Pick the option that fits the kind of event you're hosting.
+        </p>
+
+        <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
+          <button
+            v-for="p in PRESETS"
+            :key="p.id"
+            type="button"
+            :disabled="!canEdit || saving"
+            :class="[
+              'rounded-lg border p-3 text-left transition disabled:cursor-not-allowed disabled:opacity-60',
+              currentPreset === p.id
+                ? 'border-brand-700/60 bg-brand-500/10 ring-1 ring-brand-500/30'
+                : 'border-zinc-800 bg-zinc-950 hover:border-zinc-700 hover:bg-zinc-900',
+            ]"
+            @click="selectPreset(p)"
+          >
+            <div class="flex items-center justify-between">
+              <span :class="['text-sm font-medium', currentPreset === p.id ? 'text-brand-200' : 'text-zinc-100']">
+                {{ p.label }}
+              </span>
+              <span
+                v-if="currentPreset === p.id"
+                class="text-xs font-medium uppercase tracking-wider text-brand-400"
+              >Active</span>
+            </div>
+            <p class="mt-1 text-xs text-zinc-500">{{ p.description }}</p>
+          </button>
+        </div>
+
+        <p v-if="currentPreset === 'custom'" class="mt-3 rounded-md border border-amber-900/40 bg-amber-950/10 px-3 py-2 text-xs text-amber-300">
+          You're running with custom strictness settings (set under Advanced).
+        </p>
+
+        <!-- Advanced — sliders for power users who want to dial individual bands. -->
+        <details class="group mt-4 rounded-lg border border-zinc-800 bg-zinc-950">
+          <summary class="flex cursor-pointer items-center justify-between p-3 text-sm text-zinc-300">
+            <span>Advanced strictness controls</span>
+            <svg class="h-4 w-4 text-zinc-500 transition-transform group-open:rotate-180" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+              <path fill-rule="evenodd" d="M5.293 7.293a1 1 0 011.414 0L10 10.586l3.293-3.293a1 1 0 111.414 1.414l-4 4a1 1 0 01-1.414 0l-4-4a1 1 0 010-1.414z" clip-rule="evenodd" />
+            </svg>
+          </summary>
+          <div class="space-y-4 border-t border-zinc-900 p-4">
+            <p class="text-xs text-zinc-500">
+              These directly drive the band thresholds (0–100). The presets above just write
+              sensible triples for you.
+            </p>
+            <div class="grid grid-cols-1 gap-4 md:grid-cols-3">
+              <label class="block text-sm">
+                <span class="mb-1 flex items-center justify-between text-xs text-zinc-400">
+                  <span>Watch from</span>
+                  <span class="font-mono tabular-nums text-zinc-300">{{ thresholds.medium }}</span>
+                </span>
+                <input v-model.number="thresholds.medium" type="range" min="0" max="100"
+                       :disabled="!canEdit" class="w-full accent-brand-500"
+                       @change="saveThresholds()"
+                       @input="clampOrder('medium')" />
+              </label>
+              <label class="block text-sm">
+                <span class="mb-1 flex items-center justify-between text-xs text-zinc-400">
+                  <span>Flag from</span>
+                  <span class="font-mono tabular-nums text-zinc-300">{{ thresholds.high }}</span>
+                </span>
+                <input v-model.number="thresholds.high" type="range" min="0" max="100"
+                       :disabled="!canEdit" class="w-full accent-amber-500"
+                       @change="saveThresholds()"
+                       @input="clampOrder('high')" />
+              </label>
+              <label class="block text-sm">
+                <span class="mb-1 flex items-center justify-between text-xs text-zinc-400">
+                  <span>Refuse from</span>
+                  <span class="font-mono tabular-nums text-zinc-300">{{ thresholds.block }}</span>
+                </span>
+                <input v-model.number="thresholds.block" type="range" min="0" max="100"
+                       :disabled="!canEdit" class="w-full accent-red-500"
+                       @change="saveThresholds()"
+                       @input="clampOrder('block')" />
+              </label>
+            </div>
+          </div>
+        </details>
+      </div>
+
+      <!-- Trusted networks -->
+      <div>
+        <h3 class="mb-1 text-sm font-semibold text-zinc-100">Trusted networks</h3>
+        <p class="mb-3 text-xs text-zinc-500">
+          Guests arriving from one of these networks skip the gate entirely.
+          Useful for your home Wi-Fi, the venue's guest network, or your office —
+          places where the people connecting are already known to be your guests.
+        </p>
+
+        <div v-if="canEdit" class="mb-3 flex flex-wrap items-center gap-2">
+          <button
+            type="button"
+            class="btn-ghost text-sm"
+            :disabled="detectingIP"
+            @click="detectCurrentNetwork"
+          >
+            <svg class="mr-1 inline-block h-4 w-4" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+              <path d="M10 18a8 8 0 100-16 8 8 0 000 16zm0-2a6 6 0 100-12 6 6 0 000 12zm0-3a3 3 0 100-6 3 3 0 000 6z" />
+            </svg>
+            {{ detectingIP ? 'Detecting…' : 'Use my current network' }}
+          </button>
+          <button
+            type="button"
+            class="text-sm text-zinc-400 hover:text-zinc-200"
+            @click="showAddNetwork = !showAddNetwork"
+          >or add manually</button>
+        </div>
+
+        <!-- Manual add form — only shown when the host opens it. Inputs
+             are labelled in plain language; the placeholder hints at the
+             shape but the user can paste an IP, an IP/24, etc., and the
+             backend canonicalises. -->
+        <div v-if="canEdit && showAddNetwork" class="mb-3 rounded-md border border-zinc-800 bg-zinc-950 p-3">
+          <div class="grid grid-cols-1 gap-3 md:grid-cols-[2fr_2fr_auto]">
+            <div>
+              <label class="label">Network</label>
+              <input
+                v-model="newNetworkIP"
+                type="text"
+                class="input font-mono text-sm"
+                placeholder="e.g. 203.0.113.0/24 or 203.0.113.5"
+              />
+              <p class="mt-1 text-xs text-zinc-500">
+                Single IP or a range. <code class="text-zinc-400">/24</code> covers a typical home or office.
+              </p>
+            </div>
+            <div>
+              <label class="label">Name</label>
+              <input
+                v-model="newNetworkLabel"
+                type="text"
+                class="input text-sm"
+                placeholder="Office Wi-Fi"
+              />
+            </div>
+            <div class="flex items-end">
+              <button
+                type="button"
+                class="btn-primary text-sm"
+                :disabled="addingNetwork || !newNetworkIP.trim()"
+                @click="addNetwork"
+              >{{ addingNetwork ? 'Adding…' : 'Add' }}</button>
+            </div>
+          </div>
+        </div>
+
+        <ul v-if="allowlist.length" class="space-y-1.5">
+          <li
+            v-for="entry in allowlist"
+            :key="entry.cidr"
+            class="flex items-center justify-between rounded-md border border-zinc-800 bg-zinc-950 px-3 py-2"
+          >
+            <div class="min-w-0 flex-1">
+              <p class="text-sm font-medium text-zinc-100">{{ entry.label || 'Trusted network' }}</p>
+              <p class="font-mono text-xs text-zinc-500">{{ entry.cidr }} · added {{ fmtDate(entry.created_at) }}</p>
+            </div>
+            <button
+              v-if="canEdit"
+              type="button"
+              class="text-xs text-zinc-400 hover:text-red-300"
+              @click="removeNetwork(entry)"
+            >Remove</button>
+          </li>
+        </ul>
+        <p v-else class="text-sm text-zinc-500">No trusted networks yet.</p>
+      </div>
+
+      <!-- Recent gate decisions -->
+      <div>
+        <h3 class="mb-1 text-sm font-semibold text-zinc-100">Recent gate decisions</h3>
+        <p class="mb-3 text-xs text-zinc-500">
+          Reviews you've made on flagged guests. Helps the gate learn what's normal for your event.
+        </p>
+        <ul v-if="feedback.length" class="space-y-1.5">
+          <li
+            v-for="f in feedback.slice(0, 10)"
+            :key="f.access_log_id"
+            class="flex items-center justify-between rounded-md border border-zinc-800 bg-zinc-950 px-3 py-2 text-sm"
+          >
+            <div class="min-w-0 flex-1">
+              <p class="text-zinc-200">
+                <strong :class="f.verdict === 'legitimate' ? 'text-brand-300' : 'text-red-300'">
+                  {{ verdictLabel(f.verdict) }}
+                </strong>
+                <span class="ml-1 text-xs text-zinc-500">· {{ fmtDate(f.created_at) }}</span>
+              </p>
+              <p v-if="f.note" class="truncate text-xs text-zinc-500">{{ f.note }}</p>
+            </div>
+          </li>
+          <li v-if="feedback.length > 10" class="text-xs text-zinc-500">
+            and {{ feedback.length - 10 }} more.
+          </li>
+        </ul>
+        <p v-else class="text-sm text-zinc-500">No decisions to review yet — the gate hasn't flagged anyone.</p>
+      </div>
+    </div>
+
+    <Teleport to="body">
+      <Transition
+        enter-active-class="transition duration-200 ease-out"
+        enter-from-class="translate-y-2 opacity-0"
+        enter-to-class="translate-y-0 opacity-100"
+        leave-active-class="transition duration-200 ease-in"
+        leave-from-class="translate-y-0 opacity-100"
+        leave-to-class="translate-y-2 opacity-0"
+      >
+        <button
+          v-if="toast"
+          type="button"
+          class="fixed bottom-6 right-6 z-50 flex max-w-sm items-center gap-2 rounded-lg border px-4 py-3 text-left text-sm shadow-lg backdrop-blur"
+          :class="toast.kind === 'success'
+            ? 'border-brand-700/60 bg-brand-950/90 text-brand-100'
+            : 'border-red-800/60 bg-red-950/90 text-red-100'"
+          role="status"
+          @click="toast = null"
+        >{{ toast.text }}</button>
+      </Transition>
+    </Teleport>
+  </section>
+</template>
diff --git a/frontend/components/SecurityCard.vue b/frontend/components/SecurityCard.vue
deleted file mode 100644
index 8ebb391..0000000
--- a/frontend/components/SecurityCard.vue
+++ /dev/null
@@ -1,386 +0,0 @@
-<script setup lang="ts">
-// Tier 2 Block G — security controls for one event.
-//
-// Three concerns share this card because they're conceptually one
-// surface ("tune the fraud detector for this event"):
-//   1. Thresholds — what score counts as medium/high/block.
-//   2. Allowlist — CIDRs that bypass scoring entirely.
-//   3. Feedback inbox — host verdicts on past flagged accesses (the
-//      seed corpus for the future ML model).
-//
-// Reads are viewer+; writes (PUT/POST/DELETE) are editor+. The server
-// enforces the role gate; this component just hides write affordances
-// from viewers so the buttons don't promise something a click would
-// reject.
-
-interface Thresholds {
-  medium: number
-  high: number
-  block: number
-  defaults: { medium: number; high: number; block: number }
-}
-
-interface AllowlistEntry {
-  event_id: string
-  cidr: string
-  label?: string
-  created_at: string
-}
-
-interface FeedbackEntry {
-  access_log_id: string
-  verdict: 'legitimate' | 'suspicious'
-  note?: string
-  created_at: string
-}
-
-const props = defineProps<{
-  eventId: string
-  yourRole?: 'owner' | 'editor' | 'viewer' | null
-}>()
-
-const canEdit = computed(() => props.yourRole === 'owner' || props.yourRole === 'editor')
-
-// --- state ---
-const loading = ref(true)
-const error = ref<string | null>(null)
-const saving = ref(false)
-
-const thresholds = ref<Thresholds>({ medium: 30, high: 60, block: 85, defaults: { medium: 30, high: 60, block: 85 } })
-const allowlist = ref<AllowlistEntry[]>([])
-const feedback = ref<FeedbackEntry[]>([])
-
-// Inline-add form for new CIDR rows.
-const newCIDR = ref('')
-const newLabel = ref('')
-const addingCIDR = ref(false)
-
-// Toast — same shape as the BrandingCard toast.
-type Toast = { kind: 'success' | 'error'; text: string }
-const toast = ref<Toast | null>(null)
-let toastTimer: ReturnType<typeof setTimeout> | null = null
-function showToast(t: Toast, ms = 4000) {
-  toast.value = t
-  if (toastTimer) clearTimeout(toastTimer)
-  toastTimer = setTimeout(() => { toast.value = null }, ms)
-}
-
-async function refresh() {
-  loading.value = true
-  error.value = null
-  try {
-    const [th, al, fb] = await Promise.all([
-      useApi<Thresholds>(`/events/${props.eventId}/security/thresholds`),
-      useApi<{ entries: AllowlistEntry[] }>(`/events/${props.eventId}/security/allowlist`),
-      useApi<{ feedback: FeedbackEntry[] }>(`/events/${props.eventId}/security/feedback`),
-    ])
-    thresholds.value = th
-    allowlist.value = al.entries || []
-    feedback.value = fb.feedback || []
-  } catch (e: any) {
-    error.value = useErrMessage(e, 'Could not load security settings')
-  } finally {
-    loading.value = false
-  }
-}
-onMounted(refresh)
-
-// --- thresholds ---
-
-// Keep the three sliders mutually ordered: dragging medium past high
-// pushes high; same for high past block. Without this the host can
-// momentarily produce an invalid ordering and submit it — server
-// would 400 but the form feels broken.
-function clampOrder(which: 'medium' | 'high' | 'block') {
-  if (which === 'medium' && thresholds.value.medium > thresholds.value.high) {
-    thresholds.value.high = thresholds.value.medium
-  }
-  if (which === 'high') {
-    if (thresholds.value.high < thresholds.value.medium) thresholds.value.medium = thresholds.value.high
-    if (thresholds.value.high > thresholds.value.block) thresholds.value.block = thresholds.value.high
-  }
-  if (which === 'block' && thresholds.value.block < thresholds.value.high) {
-    thresholds.value.high = thresholds.value.block
-  }
-}
-
-async function saveThresholds() {
-  saving.value = true
-  try {
-    await useApi(`/events/${props.eventId}/security/thresholds`, {
-      method: 'PUT',
-      body: {
-        medium: thresholds.value.medium,
-        high: thresholds.value.high,
-        block: thresholds.value.block,
-      },
-    })
-    showToast({ kind: 'success', text: 'Thresholds saved.' })
-  } catch (e: any) {
-    showToast({ kind: 'error', text: useErrMessage(e, 'Could not save thresholds') })
-  } finally {
-    saving.value = false
-  }
-}
-
-function resetThresholds() {
-  thresholds.value.medium = thresholds.value.defaults.medium
-  thresholds.value.high = thresholds.value.defaults.high
-  thresholds.value.block = thresholds.value.defaults.block
-}
-
-// --- allowlist ---
-
-async function addCIDR() {
-  if (!newCIDR.value.trim()) return
-  addingCIDR.value = true
-  try {
-    await useApi(`/events/${props.eventId}/security/allowlist`, {
-      method: 'POST',
-      body: { cidr: newCIDR.value.trim(), label: newLabel.value.trim() },
-    })
-    newCIDR.value = ''
-    newLabel.value = ''
-    showToast({ kind: 'success', text: 'Allowlist entry added.' })
-    await refresh()
-  } catch (e: any) {
-    showToast({ kind: 'error', text: useErrMessage(e, 'Could not add allowlist entry') })
-  } finally {
-    addingCIDR.value = false
-  }
-}
-
-async function removeCIDR(entry: AllowlistEntry) {
-  if (!confirm(`Remove allowlist entry ${entry.cidr}?`)) return
-  try {
-    await useApi(
-      `/events/${props.eventId}/security/allowlist?cidr=${encodeURIComponent(entry.cidr)}`,
-      { method: 'DELETE' },
-    )
-    showToast({ kind: 'success', text: 'Allowlist entry removed.' })
-    await refresh()
-  } catch (e: any) {
-    showToast({ kind: 'error', text: useErrMessage(e, 'Could not remove allowlist entry') })
-  }
-}
-
-function fmtDate(iso?: string | null) {
-  if (!iso) return ''
-  try { return new Date(iso).toLocaleDateString() } catch { return iso }
-}
-</script>
-
-<template>
-  <section class="card">
-    <header class="mb-3 flex items-center justify-between">
-      <div>
-        <h2 class="text-lg font-semibold">Security</h2>
-        <p class="text-xs text-zinc-500">
-          Tune the fraud detector for this event.
-        </p>
-      </div>
-    </header>
-
-    <p v-if="error" class="mb-3 text-sm text-red-400">{{ error }}</p>
-    <p v-if="loading" class="text-sm text-zinc-500">Loading security settings…</p>
-
-    <div v-else class="space-y-8">
-      <!-- Thresholds -->
-      <div>
-        <div class="mb-3 flex items-center justify-between">
-          <div>
-            <h3 class="text-sm font-semibold text-zinc-100">Risk thresholds</h3>
-            <p class="text-xs text-zinc-500">
-              Scores at or above each cut-off land in that band. Defaults work for most events.
-            </p>
-          </div>
-          <div class="flex items-center gap-2">
-            <button
-              v-if="canEdit"
-              type="button"
-              class="text-xs text-zinc-400 hover:text-zinc-200"
-              @click="resetThresholds"
-            >Reset to defaults</button>
-            <button
-              v-if="canEdit"
-              type="button"
-              class="btn-primary text-sm"
-              :disabled="saving"
-              @click="saveThresholds"
-            >{{ saving ? 'Saving…' : 'Save thresholds' }}</button>
-          </div>
-        </div>
-
-        <!-- Visual band ribbon: each segment width matches its threshold
-             range. Gives the host an at-a-glance read of where their
-             cut-offs sit, instead of three abstract numbers. -->
-        <div class="mb-4 h-2 w-full overflow-hidden rounded-full bg-zinc-900">
-          <div class="flex h-full w-full">
-            <div :style="{ width: thresholds.medium + '%' }" class="bg-brand-700"></div>
-            <div :style="{ width: (thresholds.high - thresholds.medium) + '%' }" class="bg-amber-700"></div>
-            <div :style="{ width: (thresholds.block - thresholds.high) + '%' }" class="bg-orange-700"></div>
-            <div :style="{ width: (100 - thresholds.block) + '%' }" class="bg-red-700"></div>
-          </div>
-        </div>
-
-        <div class="grid grid-cols-1 gap-4 md:grid-cols-3">
-          <label class="block text-sm">
-            <span class="mb-1 flex items-center justify-between text-xs text-zinc-400">
-              <span><span class="inline-block h-2 w-2 rounded-full bg-brand-500 mr-1.5"></span>Medium</span>
-              <span class="font-mono tabular-nums text-zinc-300">{{ thresholds.medium }}</span>
-            </span>
-            <input
-              v-model.number="thresholds.medium"
-              type="range"
-              min="0"
-              max="100"
-              :disabled="!canEdit"
-              class="w-full accent-brand-500"
-              @input="clampOrder('medium')"
-            />
-          </label>
-          <label class="block text-sm">
-            <span class="mb-1 flex items-center justify-between text-xs text-zinc-400">
-              <span><span class="inline-block h-2 w-2 rounded-full bg-amber-500 mr-1.5"></span>High</span>
-              <span class="font-mono tabular-nums text-zinc-300">{{ thresholds.high }}</span>
-            </span>
-            <input
-              v-model.number="thresholds.high"
-              type="range"
-              min="0"
-              max="100"
-              :disabled="!canEdit"
-              class="w-full accent-amber-500"
-              @input="clampOrder('high')"
-            />
-          </label>
-          <label class="block text-sm">
-            <span class="mb-1 flex items-center justify-between text-xs text-zinc-400">
-              <span><span class="inline-block h-2 w-2 rounded-full bg-red-500 mr-1.5"></span>Block</span>
-              <span class="font-mono tabular-nums text-zinc-300">{{ thresholds.block }}</span>
-            </span>
-            <input
-              v-model.number="thresholds.block"
-              type="range"
-              min="0"
-              max="100"
-              :disabled="!canEdit"
-              class="w-full accent-red-500"
-              @input="clampOrder('block')"
-            />
-          </label>
-        </div>
-      </div>
-
-      <!-- Allowlist -->
-      <div>
-        <h3 class="mb-1 text-sm font-semibold text-zinc-100">IP allowlist</h3>
-        <p class="mb-3 text-xs text-zinc-500">
-          Networks that bypass scoring. Use for office Wi-Fi, the venue's
-          guest network, or a family router. Accepts a single IP or a CIDR
-          range. Score is forced to 0 for matching requests.
-        </p>
-
-        <div v-if="canEdit" class="mb-3 flex items-end gap-2">
-          <div class="flex-1">
-            <label class="label">CIDR</label>
-            <input
-              v-model="newCIDR"
-              type="text"
-              placeholder="203.0.113.0/24 or 10.0.0.42"
-              class="input font-mono text-sm"
-            />
-          </div>
-          <div class="flex-1">
-            <label class="label">Label (optional)</label>
-            <input
-              v-model="newLabel"
-              type="text"
-              placeholder="Office Wi-Fi"
-              class="input text-sm"
-            />
-          </div>
-          <button
-            type="button"
-            class="btn-primary text-sm"
-            :disabled="addingCIDR || !newCIDR.trim()"
-            @click="addCIDR"
-          >{{ addingCIDR ? 'Adding…' : 'Add' }}</button>
-        </div>
-
-        <ul v-if="allowlist.length" class="space-y-1.5">
-          <li
-            v-for="entry in allowlist"
-            :key="entry.cidr"
-            class="flex items-center justify-between rounded-md border border-zinc-800 bg-zinc-950 px-3 py-2"
-          >
-            <div class="min-w-0 flex-1">
-              <p class="font-mono text-sm text-zinc-100">{{ entry.cidr }}</p>
-              <p class="text-xs text-zinc-500">
-                {{ entry.label || 'no label' }} · added {{ fmtDate(entry.created_at) }}
-              </p>
-            </div>
-            <button
-              v-if="canEdit"
-              type="button"
-              class="text-xs text-zinc-400 hover:text-red-300"
-              @click="removeCIDR(entry)"
-            >Remove</button>
-          </li>
-        </ul>
-        <p v-else class="text-sm text-zinc-500">No allowlist entries yet.</p>
-      </div>
-
-      <!-- Feedback inbox — read-only summary; the actual "mark legitimate / suspicious"
-           lives on the live monitor / activity feed where the host sees the
-           access in context. This is the audit trail. -->
-      <div>
-        <h3 class="mb-1 text-sm font-semibold text-zinc-100">Verdict history</h3>
-        <p class="mb-3 text-xs text-zinc-500">
-          Your previous "legitimate" / "suspicious" marks on flagged accesses. Seeds the model and silences known false positives.
-        </p>
-        <ul v-if="feedback.length" class="space-y-1.5">
-          <li
-            v-for="f in feedback.slice(0, 10)"
-            :key="f.access_log_id"
-            class="flex items-center justify-between rounded-md border border-zinc-800 bg-zinc-950 px-3 py-2 text-sm"
-          >
-            <div class="min-w-0 flex-1">
-              <p class="text-zinc-200">
-                Marked <strong :class="f.verdict === 'legitimate' ? 'text-brand-300' : 'text-red-300'">{{ f.verdict }}</strong>
-                <span class="ml-1 text-xs text-zinc-500">· {{ fmtDate(f.created_at) }}</span>
-              </p>
-              <p v-if="f.note" class="truncate text-xs text-zinc-500">{{ f.note }}</p>
-            </div>
-          </li>
-          <li v-if="feedback.length > 10" class="text-xs text-zinc-500">
-            and {{ feedback.length - 10 }} more.
-          </li>
-        </ul>
-        <p v-else class="text-sm text-zinc-500">No verdicts yet.</p>
-      </div>
-    </div>
-
-    <Teleport to="body">
-      <Transition
-        enter-active-class="transition duration-200 ease-out"
-        enter-from-class="translate-y-2 opacity-0"
-        enter-to-class="translate-y-0 opacity-100"
-        leave-active-class="transition duration-200 ease-in"
-        leave-from-class="translate-y-0 opacity-100"
-        leave-to-class="translate-y-2 opacity-0"
-      >
-        <button
-          v-if="toast"
-          type="button"
-          class="fixed bottom-6 right-6 z-50 flex max-w-sm items-center gap-2 rounded-lg border px-4 py-3 text-left text-sm shadow-lg backdrop-blur"
-          :class="toast.kind === 'success'
-            ? 'border-brand-700/60 bg-brand-950/90 text-brand-100'
-            : 'border-red-800/60 bg-red-950/90 text-red-100'"
-          role="status"
-          @click="toast = null"
-        >{{ toast.text }}</button>
-      </Transition>
-    </Teleport>
-  </section>
-</template>
diff --git a/frontend/pages/dashboard/events/[id].vue b/frontend/pages/dashboard/events/[id].vue
index ab06ecb..9f3a01e 100644
--- a/frontend/pages/dashboard/events/[id].vue
+++ b/frontend/pages/dashboard/events/[id].vue
@@ -69,14 +69,16 @@ const loading = ref(true)
 // (Collaborators + Branding, configured once) → Analytics (results,
 // checked periodically). The two action-y tabs anchor the ends; setup
 // clusters in the middle.
-type EventTab = 'guests' | 'collaborators' | 'branding' | 'analytics' | 'security'
-const validTabs: EventTab[] = ['guests', 'collaborators', 'branding', 'analytics', 'security']
+type EventTab = 'guests' | 'collaborators' | 'branding' | 'analytics' | 'gate'
+const validTabs: EventTab[] = ['guests', 'collaborators', 'branding', 'analytics', 'gate']
 function tabFromHash(): EventTab {
   if (import.meta.client) {
     const h = window.location.hash.replace('#', '') as EventTab
     if (validTabs.includes(h)) return h
     // Block C / preview alias: older share links used #team.
     if (h === ('team' as EventTab)) return 'collaborators'
+    // Block G rebrand: #security → #gate so old links don't 404.
+    if (h === ('security' as EventTab)) return 'gate'
   }
   return 'guests'
 }
@@ -785,7 +787,7 @@ function checkLabel(band?: string): string {
           { id: 'collaborators', label: 'Collaborators' },
           { id: 'branding',      label: 'Branding' },
           { id: 'analytics',     label: 'Analytics' },
-          { id: 'security',      label: 'Security' },
+          { id: 'gate',          label: 'Gate' },
         ] as { id: EventTab, label: string }[]"
         :key="t.id"
         role="tab"
@@ -1210,10 +1212,12 @@ function checkLabel(band?: string): string {
       <TeamCard :event-id="eventId" :your-role="event.your_role" />
     </div>
 
-    <!-- Security (Tier 2 Block G). Per-event thresholds, IP allowlist,
-         feedback inbox. Editor+ for writes, viewer+ for reads. -->
-    <div v-if="activeTab === 'security' && event" class="mt-2">
-      <SecurityCard :event-id="eventId" :your-role="event.your_role" />
+    <!-- Gate (Tier 2 Block G). The user-facing rebrand of the fraud
+         detector: strictness presets + trusted networks + decision
+         history, with the technical sliders/CIDR jargon tucked behind
+         disclosure. Editor+ for writes, viewer+ for reads. -->
+    <div v-if="activeTab === 'gate' && event" class="mt-2">
+      <GateCard :event-id="eventId" :your-role="event.your_role" />
     </div>
 
     <!-- ===== Modals ===== -->
diff --git a/frontend/pages/rsvp/[token].vue b/frontend/pages/rsvp/[token].vue
index a66b7c4..8f354c0 100644
--- a/frontend/pages/rsvp/[token].vue
+++ b/frontend/pages/rsvp/[token].vue
@@ -190,10 +190,8 @@ const submitLabel = computed(() => {
     <div v-else-if="result?.blocked" class="card border-red-900/60 bg-red-950/30">
       <h1 class="mb-2 text-xl font-semibold text-red-200">This invitation cannot be used</h1>
       <p class="text-sm text-red-300">
-        The host has been notified of a suspicious access attempt.
-      </p>
-      <p class="mt-3 text-xs text-red-400">
-        Risk score {{ result.fraud.score }} · {{ result.fraud.risk }}
+        Something about this attempt looked off and the host has been notified.
+        If you believe this is a mistake, please reach out to them directly.
       </p>
     </div>
 
@@ -205,10 +203,6 @@ const submitLabel = computed(() => {
         Response recorded as <strong>{{ result.rsvp.response }}</strong> with
         +{{ result.rsvp.plus_ones }} plus-ones.
       </p>
-      <p class="mt-3 text-xs text-zinc-500">
-        Risk score {{ result.fraud.score }} · {{ result.fraud.risk }}
-        <span v-if="!result.fraud.used"> · fallback</span>
-      </p>
 
       <AddToCalendar
         v-if="calendar && result.rsvp.response === 'attending'"
diff --git a/internal/api/me.go b/internal/api/me.go
index 4b1e517..c66a273 100644
--- a/internal/api/me.go
+++ b/internal/api/me.go
@@ -30,3 +30,20 @@ func (h *meHandler) get(w http.ResponseWriter, r *http.Request) {
 	}
 	writeJSON(w, http.StatusOK, u)
 }
+
+// GET /me/public-ip — returns the IP the API sees the caller from.
+// Powers the Gate tab's "Use my current network" button so a host can
+// allowlist their own home / office Wi-Fi with one click rather than
+// learning what a CIDR is. Tier 2 Block G UX rebrand.
+//
+// In production behind an ingress proxy the real public IP arrives via
+// X-Forwarded-For (handled by clientIP); in dev with Docker Desktop the
+// caller's apparent IP is the bridge gateway (~192.168.65.1), which is
+// still the right value to allowlist for local hosts.
+func (h *meHandler) publicIP(w http.ResponseWriter, r *http.Request) {
+	if _, ok := UserIDFromContext(r.Context()); !ok {
+		writeError(w, http.StatusUnauthorized, "unauthenticated")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"ip": clientIP(r)})
+}
diff --git a/internal/api/server.go b/internal/api/server.go
index 457912e..167df23 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -327,6 +327,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /auth/reset-password", s.authH.resetPassword)
 
 	mux.Handle("GET /me", authed(http.HandlerFunc(s.me.get)))
+	mux.Handle("GET /me/public-ip", authed(http.HandlerFunc(s.me.publicIP)))
 	mux.Handle("POST /auth/ws-ticket", authed(http.HandlerFunc(s.wsTicket.issue)))
 
 	// Privacy / GDPR-style endpoints — host can export their data,